Password has expired: SonarQube LDAP authentication failure

Problem context

When an LDAP user’s password expires, SonarQube 9.x logs an explicit error message: "Password has expired". However, the application does not provide a built‑in mechanism to surface this condition to administrators or to enforce least‑privilege role cleanup after a credential change.

Goal

Identify a reliable method to detect expired credentials for both internal and LDAP users, and to ensure that role assignments remain minimal after such events.

Constraints

• Internal passwords are stored hashed; SonarQube does not enforce expiration.
• LDAP expiration is governed by the directory, and SonarQube only surfaces the error.
• Granting SONAR_ADMIN for troubleshooting conflicts with least‑privilege principles.

Unresolved questions

1. What configuration or plugin can automatically detect and flag expired internal passwords in SonarQube?
2. Is there a system property that can trigger an alert when an LDAP password expires, beyond the standard error log?
3. What audit workflow can be established to review and adjust role assignments when a password expiration event occurs?